---
id: "CVE-2026-123391"
page: "https://infrastack.ai/live/CVE-2026-123391"
kind: "vulnerability"
aliases: ["CVE-2026-123391"]
title: "SharePoint Server Subscription Edition: authorized users can escalate privileges over the network"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SharePoint Server Subscription Edition", "fixed": ["16.0.20326.20136"], "affected": ">= 16.0.0, < 16.0.20326.20136", "ecosystem": "vendor"}]
ecosystems: []
tags: ["microsoft", "microsoft-office", "on-premises", "self-hosted", "sharepoint", "vendor"]
not_affected_if: ["no-sharepoint", "sharepoint-online-only"]
published_at: "2026-11-10T19:20:43+00:00"
first_seen_at: "2026-11-10T19:25:12+00:00"
updated_at: "2026-11-10T21:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123391", "first_seen_at": "2026-11-10T19:25:12+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-123391", "first_seen_at": "2026-11-10T21:30:05+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-123391"]}]
exploit_sources: []
---

# SharePoint Server Subscription Edition: authorized users can escalate privileges over the network

Link for people: https://infrastack.ai/live/CVE-2026-123391 (this .md is for agents)

Microsoft Office SharePoint has an incorrect authorization check that lets a logged-in user raise their privileges across the network. An attacker who already holds a valid account can gain rights beyond what they were granted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SharePoint Server Subscription Edition affected >= 16.0.0, < 16.0.20326.20136 fixed 16.0.20326.20136

## How to check

Run (Get-SPFarm).BuildVersion in the SharePoint Management Shell, or check Central Administration > Upgrade and Migration > Check product and patch installation status. Builds below 16.0.20326.20136 are affected. Also check SharePoint 2016/2019 farms against the MSRC page; the CNA record lists only Subscription Edition.

## Fix

Update SharePoint Server Subscription Edition to build 16.0.20326.20136 or later (per Microsoft's CVE record; the KB number was not read, see the MSRC page).

## Timeline

- 2026-11-10T19:25:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123391
- 2026-11-10T21:30:05+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-123391 — Read Microsoft's CNA CVE record (cveawg); MSRC page is JS-only and unreadable, so fix KB and 2016/2019/Online status not confirmed there. Not exploited, no PoC; CVSS 8.8, E:U. Fix and how-to-check left unverified.

## Documents

- [advisory] CVE-2026-123391 CVE record published by Microsoft (CNA) https://cveawg.mitre.org/api/cve/CVE-2026-123391

## From the sources

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_